# V7 agent authentication This page summarizes how AI agents should discover and use V7 authentication resources. ## Discovery routes Primary auth guide: /auth.md Human-readable auth page: /auth OAuth protected resource metadata: /.well-known/oauth-protected-resource OAuth authorization server metadata: /.well-known/oauth-authorization-server API overview: /api Developer hub: /developers ## Credential lifecycle 1. Discover the relevant V7 API or workflow resource. 2. Confirm whether the task should use production, sandbox, or test mode. 3. Request credentials through the official V7 app, docs, or contact flow. 4. Store and use credentials only in approved secure agent runtime storage. 5. Use bearer credentials over HTTPS. 6. Revoke or rotate credentials if exposed. ## Agent safety Agents should not ask users to paste long-lived production secrets into chat. Agents should prefer scoped credentials, sandbox environments, and explicit user confirmation for write or destructive operations. Keywords: agent_auth, register_uri, identity_assertion, id-jag, WWW-Authenticate.